CVE-2018-25045

    Dashboard / Vulnerabilities / CVE-2018-25045

    CVE-2018-25045

    Published: 23 Jul 2022Last Modified: 8 Jul 2026

    Summary:

    Details: Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

    References: https://github.com/encode/django-rest-framework/pull/6191, https://github.com/encode/django-rest-framework/pull/6330, https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -453196e9c3a581bac3bf68eb8c9cdd7d28d2dcd6

    Affected versions

    3.8.2
    3.8.1
    3.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-25045 | CVE-DB